Baiting

False promise (free download, dropped USB drive) lures the victim into installing malware

categorySocial engineering and human-targeted attacksseverityMediumdetectabilityHighlabnot yet measured

Classification

34 values: 19 imported, 1 derived, 14 machine-classified. What do these mean?

Exploitability

Attack vector	Social engineering
Reach (CVSS)	Social
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	Medium
Impact	ConfidentialityIntegrity
Platform	ContainersIaaSLinuxmacOSWindows
Environment	On-premises
Target asset class	EndpointHuman
Kill-chain phase (tactic)	Execution

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentContainer CreationContainer StartFile AccessFile CreationFile ModificationInstance CreationInstance StartNetwork Connection CreationNetwork Traffic ContentProcess Creation

Detection & response

Mitigated by 36

M1017 attack-mitigation
M1021 attack-mitigation
M1031 attack-mitigation
M1033 attack-mitigation
M1038 attack-mitigation
M1040 attack-mitigation
D3-APCA d3fend
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-CSPP d3fend
D3-DA d3fend
D3-DF d3fend
D3-EAL d3fend
D3-EDL d3fend
D3-EFA d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-HD d3fend
D3-IAA d3fend
D3-LFP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-OTF d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RPA d3fend
D3-RTSD d3fend
D3-UA d3fend
D3-UGLPA d3fend
D3-URA d3fend

Detected by 58

DET0478 attack-detection-strategy
00d0b5ab-1f55-4120-8e83-487c0a7baf19 sigma
1193d960-2369-499f-a158-7b50a31df682 sigma
1337afba-d17d-4d23-bd55-29b927603b30 sigma
1412aa78-a24c-4abd-83df-767dfb2c5bbe sigma
208748f7-881d-47ac-a29c-07ea84bf691d sigma
234dc5df-40b5-49d1-bf53-0d44ce778eca sigma
24de4f3b-804c-4165-b442-5a06a2302c7e sigma
28208707-fe31-437f-9a7f-4b1108b94d2e sigma
289dfa9e-e378-4a56-a9d4-7ed5ee218029 sigma
29fd07fc-9cfd-4331-b7fd-cc18dfa21052 sigma
3ae9974a-eb09-4044-8e70-8980a50c12c8 sigma
3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e sigma
401e5d00-b944-11ea-8f9a-00163ecd60ae sigma
438025f9-5856-4663-83f7-52f878a70a50 sigma
4922a5dd-6743-4fc2-8e81-144374280997 sigma
4fee3d51-8069-4a4c-a0f7-924fcaff2c70 sigma
5325945e-f1f0-406e-97b8-65104d393fff sigma
557e3bd3-7f21-495d-8d50-7c8bdfb8041c sigma
60936b49-fca0-4f32-993d-7415edcf9a5d sigma
678eb5f4-8597-4be6-8be7-905e4234b53a sigma
69483748-1525-4a6c-95ca-90dc8d431b68 sigma
6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e sigma
6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 sigma
7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e sigma
7bdde3bf-2a42-4c39-aa31-a92b3e17afac sigma
864403a1-36c9-40a2-a982-4c9a45f7d833 sigma
8a582fe2-0882-4b89-a82a-da6b2dc32937 sigma
8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e sigma
90217a70-13fc-48e4-b3db-0d836c5824ac sigma
932ac737-33ca-4afd-9869-0d48b391fcc9 sigma
965fff6c-1d7e-4e25-91fd-cdccd75f7d2c sigma
9a025188-6f2d-42f8-bb2f-d3a83d24a5af sigma
9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed sigma
9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b sigma
9cfe4b27-1e56-48b4-b7a8-d46851c91a44 sigma
a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c sigma
aa3a6f94-890e-4e22-b634-ffdfd54792cc sigma
af4c4609-5755-42fe-8075-4effb49f5d44 sigma
af5732ed-764e-489d-826d-0447c8b36242 sigma
… and 18 more in the database

Tested by 15

02f35d62-9fdc-4a97-b899-a5d9a876d295 atomic
0330a5d2-a45a-4272-a9ee-e364411c4b18 atomic
22386853-f68d-4b50-a362-de235127c443 atomic
24fd9719-7419-42dd-bce6-ab3463110b3c atomic
3f3120f0-7e50-4be2-88ae-54c61230cb9f atomic
3f3af983-118a-4fa1-85d3-ba4daa739d80 atomic
4ea1fc97-8a46-4b4e-ba48-af43d2a98052 atomic
5202ee05-c420-4148-bf5e-fd7f7d24850c atomic
581d7521-9c4b-420e-9695-2aec5241167f atomic
8bebc690-18c7-4549-bc98-210f7019efff atomic
9215ea92-1ded-41b7-9cd6-79f9a78397aa atomic
a19ee671-ed98-4e9d-b19c-d1954a51585a atomic
add560ef-20d6-4011-a937-2c340f930911 atomic
cec8ad4e-0320-4984-a1ae-70ee398c9519 atomic
e9795c8d-42aa-4ed4-ad80-551ed793d006 atomic

Attack relationships

Framework references

Primary source: https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/types-of-social-engineering-attacks/
attack: T1204 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 39 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1204 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 5 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)